#!/bin/sh
#04/04/1999
#example rc.firewall script for the newer 2.1/2.2 kernels using ipchains
#that creates user defined chains for each interface. There are firewall
#rules for spoofing protection which may be unnecessary since the newer
#kernels can have kernel spoofing protection enabled. You might say it's
#super paranoid checking.
#Send questions or comments to [email protected].
#---------------------------------------------------------------------
#Variables
#---------------------------------------------------------------------
#local ethernet interface
localip=
localif=eth0
#static ethernet interface
staticip=
staticif=eth1
#loopback interface
loopback=lo
PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
#---------------------------------------------------------------------
#Flush built-in input, output, and forward ipchains; set default policy
#Good policy to deny all packets especially while setting up chains
#---------------------------------------------------------------------
#set incoming firewall policy default to deny
ipchains -P input DENY
#flush incoming firewall policies
ipchains -F input
#---------------------------------------------------------------------
#set outgoing firewall policy default to deny
ipchains -P output DENY
#flush outgoing firewall policies
ipchains -F output
#---------------------------------------------------------------------
#set forwarding firewall policy default to deny
ipchains -P forward DENY
#flush forwarding firewall policies
ipchains -F forward
#---------------------------------------------------------------------
#flush all policies -redundant for main policies, but also flushes user
#defined policies
#ipchains -F
#remove all user defined policies - you may or may not want to enable this
#ipchains -X
#---------------------------------------------------------------------
#Incoming Firewall Policies
#---------------------------------------------------------------------
#create new input chain for static ethernet interface
ipchains -N $staticif"-i"
#flush all rules in chain (sanity flush)
ipchains -F $staticif"-i"
#block incoming tcp SYN packets to all ports on staticif and log
#this may be a little harsh but its a nice feature
#ipchains -A $staticif"-i" -j DENY -p tcp -y -i $staticif -s 0/0 \
#-d $staticip : -l
#remote interface, claiming to be local machines (IP spoofing) deny and log
ipchains -A $staticif"-i" -j DENY -i $staticif -s $localip/16 -d 0/0 -l
#remote interface, any source, going to staticip address is valid
ipchains -A $staticif"-i" -j ACCEPT -i $staticif -s 0/0 -d $staticip/32
#all other incoming is denied and logged
ipchains -A $staticif"-i" -j DENY -s 0/0 -d 0/0 -l
#---------------------------------------------------------------------
#create new input chain for local ethernet interface
ipchains -N $localif"-i"
#flush all rules in chain (sanity flush)
ipchains -F $localif"-i"
#local interface, local machines, going anywhere is valid
ipchains -A $localif"-i" -j ACCEPT -i $localif -s $localip/24 -d 0/0
#all other incoming is denied and logged
ipchains -A $localif"-i" -j DENY -s 0/0 -d 0/0 -l
#---------------------------------------------------------------------
#create new input chain for loopback interface
ipchains -N $loopback"-i"
#flush all rules in chain (sanity flush)
ipchains -F $loopback"-i"
#loopback interface is valid
ipchains -A $loopback"-i" -j ACCEPT -i $loopback -s 0/0 -d 0/0
#all other incoming is denied and logged
ipchains -A $loopback"-i" -j DENY -s 0/0 -d 0/0 -l
#--------------------------------------------------------------------------
#Forwarding firewall policies
#--------------------------------------------------------------------------
#create new forward chain for static ethernet interface
ipchains -N $staticif"-f"
#flush all rules in chain (sanity flush)
ipchains -F $staticif"-f"
#masquerade from localnet on static interface to anywhere
ipchains -A $staticif"-f" -j MASQ -i $staticif -s $localip/24 -d 0/0
#all other forwarding is denied and logged
ipchains -A $staticif"-f" -j DENY -s 0/0 -d 0/0 -l
#---------------------------------------------------------------------
#create new forward chain for local ethernet interface
ipchains -N $localif"-f"
#flush all rules in chain (sanity flush)
ipchains -F $localif"-f"
#all other forwarding is denied and logged
ipchains -A $localif"-f" -j DENY -s 0/0 -d 0/0 -l
#---------------------------------------------------------------------
#create new forward chain for loopback interface
ipchains -N $loopback"-f"
#flush all rules in chain (sanity flush)
ipchains -F $loopback"-f"
#all other forwarding is denied and logged
ipchains -A $loopback"-f" -j DENY -s 0/0 -d 0/0 -l
#---------------------------------------------------------------------
#Outgoing Firewall Policies
#---------------------------------------------------------------------
#create new output chain for static ethernet interface
ipchains -N $staticif"-o"
#flush all rules in chain (sanity flush)
ipchains -F $staticif"-o"
#outgoing to localnet on remote interface(stuffed routing) deny & log
ipchains -A $staticif"-o" -j DENY -i $staticif -s 0/0 -d $localip/24 -l
#outgoing from local net on remote interface, stuffed masquerading, deny
ipchains -A $staticif"-o" -j DENY -i $staticif -s $localip/24 -d 0/0 -l
#anything else outgoing on remote interface is valid
ipchains -A $staticif"-o" -j ACCEPT -i $staticif -s $staticip/32 -d 0/0
#all other outgoing is denied and logged
ipchains -A $staticif"-o" -j DENY -s 0/0 -d 0/0 -l
#---------------------------------------------------------------------
#create new output chain for local ethernet interface
ipchains -N $localif"-o"
#flush all rules in chain (sanity flush)
ipchains -F $localif"-o"
#local interface, any source going to local net is valid
ipchains -A $localif"-o" -j ACCEPT -i $localif -s 0/0 -d $localip/24
#all other outgoing is denied and logged
ipchains -A $localif"-o" -j DENY -s 0/0 -d 0/0 -l
#---------------------------------------------------------------------
#create new output chain for loopback interface
ipchains -N $loopback"-o"
#flush all rules in chain (sanity flush)
ipchains -F $loopback"-o"
#loopback interface is valid
ipchains -A $loopback"-o" -j ACCEPT -i $loopback -s 0/0 -d 0/0
#all other outgoing is denied and logged
ipchains -A $loopback"-o" -j DENY -s 0/0 -d 0/0 -l
#--------------------------------------------------------------------------
#make sure forwarding is enabled in the kernel
#--------------------------------------------------------------------------
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward
#--------------------------------------------------------------------------
#Add pointers to built-in chains to enable user defined chains
#change the order in each chain to optimize filtering for an interface
#--------------------------------------------------------------------------
#add local interface input chain
ipchains -A input -i $localif -j $localif"-i"
#add static interface input chain
ipchains -A input -i $staticif -j $staticif"-i"
#add loopback interface input chain
ipchains -A input -i $loopback -j $loopback"-i"
#-------------------------------------------------------------------------
#add local interface output chain
ipchains -A output -i $localif -j $localif"-o"
#add static interface output chain
ipchains -A output -i $staticif -j $staticif"-o"
#add loopback interface output chain
ipchains -A output -i $loopback -j $loopback"-o"
#-------------------------------------------------------------------------
#add local interface forward chain
ipchains -A forward -i $localif -j $localif"-f"
#add static interface forward chain
ipchains -A forward -i $staticif -j $staticif"-f"
#add loopback interface forward chain
ipchains -A forward -i $loopback -j $loopback"-f"
#---------------------------------------------------------------------
#Super Paranoid check --- even though default policy is set for deny,
#block all packets on any interface
#---------------------------------------------------------------------
#all other incoming is denied and logged
ipchains -A input -j DENY -s 0/0 -d 0/0 -l
#all other output is denied and logged
ipchains -A output -j DENY -s 0/0 -d 0/0 -l
#all other forwarding is denied and logged
ipchains -A forward -j DENY -s 0/0 -d 0/0 -l
exit 0